Privacy Policy

1. Basic Principles

Sogorox ("Company", "we", "our", or "us") is committed to protecting your personal data in accordance with the Personal Information Protection Act (PIPA) and other applicable laws. This Privacy Policy describes how we collect, use, and protect your information.

We only collect information that is necessary for providing our services, processing payments, and improving your user experience. We never sell your personal data to third parties.

Chief Privacy Officer (CPO): Sogorox CEO | Contact: privacy@sogorox.com

2. Information We Collect

We collect the following types of information to provide and improve our services:

Personal Information

When you register or make a purchase, we collect:

• Name and email address
• Billing information (processed securely through third-party payment processors)
• Purchase history and license information
• OAuth integration: Social account unique ID

Automatically Collected Data

The following information is automatically collected during your use of the Service:

• IP address, browser type, and operating system
• Device type and screen resolution
• Login method, session ID, and access time
• Pages visited, click paths, and time spent
• Referral URL

3. Purpose of Collection and Use

We use the collected personal information for the following purposes:

• Service provision and member management: Registration, identity verification, account management
• Payment and settlement: Product purchases, refund processing, license issuance
• Customer support: Inquiry response, dispute resolution, notice delivery
• Service improvement: Usage statistics analysis, new service development, personalized recommendations
• Marketing (optional consent): Promotional notifications, newsletter distribution
• Legal compliance: Compliance with e-commerce laws, tax laws, and other applicable regulations

4. Retention Period

We destroy personal information without delay once the purpose of collection and use has been achieved. However, where retention is required by applicable laws, information is retained for the following periods:

• Account information: Until account deletion (destroyed within 30 days after deletion)
• Payment and transaction records: 5 years under e-commerce laws
• Login records and access logs: 3 months under telecommunications laws
• Consumer complaint and dispute records: 3 years under e-commerce laws
• Tax-related records: 5 years under tax laws

5. Disclosure to Third Parties

We do not provide personal information to third parties without your consent in principle. However, the following exceptions apply:

• Payment processing: Stripe, Toss Payments, and other PCI-DSS certified payment processors
• Analytics: Google Analytics, Vercel Analytics (anonymized usage statistics)
• Infrastructure: Amazon Web Services, Cloudflare (hosting and CDN)
• Legal requests: Lawful requests from investigative or regulatory authorities

6. Your Rights

You may exercise the following rights under applicable data protection laws:

• Right to access: You may request to view your personal information held by the Company.
• Right to correction/deletion: You may request correction or deletion of inaccurate or incomplete personal information.
• Right to suspend processing: You may request suspension of personal information processing.
• Right to withdraw consent: You may withdraw consent to previously agreed personal information processing at any time.
• How to exercise: Through account settings or by contacting privacy@sogorox.com. Requests will be processed within 10 days.

7. Cookie Policy

We use cookies to provide personalized services and analyze service usage.

• Essential cookies: Required for service operation such as login state maintenance and security token management
• Analytics cookies: For page visit statistics and usage pattern analysis
• Marketing cookies: For interest-based content recommendations (optional consent)
• Cookie management: You can block or delete cookies through browser settings; some features may be limited.

8. International Data Transfers

We may transfer personal information overseas for service provision as follows:

• Amazon Web Services (AWS): United States — Service hosting and data storage
• Cloudflare: United States — CDN services and security
• Stripe: United States — Payment processing
• Google LLC: United States — Analytics services (Google Analytics)
• Transferred personal information is protected in accordance with the respective company's privacy policy, and we contractually ensure appropriate safeguards.

9. Data Security

We implement the following technical and organizational security measures to protect your personal information:

• Encryption in transit: All communications are encrypted with TLS 1.2 or higher.
• Password encryption: Passwords are securely stored using bcrypt hashing algorithm.
• Access control: Access rights for personnel handling personal information are minimized and regularly audited.
• Payment security: All payments are processed through PCI-DSS certified partners; card information is not stored on our servers.
• Security headers: Web security standard headers including X-Frame-Options, CSP, and HSTS are applied.
• Breach response: Users and regulatory authorities will be notified within 72 hours of a personal data breach.

10. AI Data Processing

We use AI technology to improve our services. Data is processed as follows:

• Data used for AI training is anonymized and converted into a form that cannot identify individuals.
• Anonymized data is used for AI model training, recommendation algorithm improvement, and content quality enhancement.
• Your personal information is not directly used for AI training; only statistical and aggregate data is utilized.
• You may express your objection to AI data processing through service settings or privacy@sogorox.com.

11. Chief Privacy Officer

The Chief Privacy Officer responsible for personal information processing is as follows:

• Title: Chief Privacy Officer (CPO)
• Organization: Sogorox
• Contact: privacy@sogorox.com
• You may contact the CPO for inquiries, complaints, or damage relief related to personal information during service use. We will respond within 10 days.

12. Effective Date and Changes

This Privacy Policy is effective as of April 4, 2026.

• Changes to this Privacy Policy will be notified through in-service announcements at least 7 days before the effective date.
• For significant changes, individual notifications via email will also be provided.
• Previous versions of this Privacy Policy can be viewed within the Service.